Loading story…
IBM documented the Mozi botnet compromising vulnerable Internet of Things (IoT) devices through command injection and delivering a payload named mozi.a. Exposed web and debugging interfaces, exploitable PHP modules, inadequate input sanitization, and delayed patching enable inexpensive, automated attacks. The analyzed payload targets MIPS architecture, and associated artifacts include network bootstrap endpoints, credential strings, firewall commands, and device-management configuration changes. India's Cyber Swachhta Kendra also published an alert on the Mozi IoT botnet.
IBM reported that 84% of observed Mozi infrastructure was sourced in China; that finding does not establish the operators' nationality or state affiliation. The supplied material does not identify specific vulnerabilities or CVEs, limiting vulnerability-specific remediation guidance. Organizations should prioritize inventorying exposed IoT devices, restricting access to management and debugging interfaces, applying vendor patches, and monitoring for unexpected outbound connections or unauthorized firewall and device-configuration changes.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
IBM reported that Mozi exploited vulnerable IoT interfaces through command injection to deliver the MIPS-targeting mozi.a payload, and supplied network endpoints, credentials, firewall commands, and device-management artifacts. IBM found that 84% of observed Mozi infrastructure was sourced in China, without establishing the operators’ nationality or state affiliation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Mozi** botnet infected routers, gateways, DVRs, NVRs, and other IoT devices through weak Telnet credentials and known vulnerabilities, then used a **DHT-based peer-to-peer** architecture to spread malware and maintain command-and-control without relying on centralized servers. Researchers said Mozi reused some Gafgyt code but stood apart for its decentralized design, XOR obfuscation, and **`ECDSA384`** signature checks that protected botnet configuration integrity. Infected devices could be directed to launch **DDoS** attacks, download and execute payloads, collect system information, and run arbitrary commands, while compromised nodes also hosted malware for further propagation over HTTP on random ports. Later analysis showed Mozi evolving beyond basic botnet activity by adding persistence mechanisms on **Netgear, Huawei, and ZTE** gateways, including startup-script changes, credential modification, service disabling, and port blocking. Microsoft reported the malware could also support **man-in-the-middle** activity such as DNS spoofing and HTTP session hijacking, raising the risk that compromised edge devices could become entry points into enterprise IT and OT networks. Netlab and other researchers found that even after action against its operators and a slowdown in updates, Mozi’s decentralized network continued to sustain lingering infections, while newer variants added Mirai-style C2 logic for DDoS coordination, UPnP port mapping, and additional node roles tied to mining activity.
Aug 15, 2026
Cybersecurity researchers have reported a significant surge in automated attacks against PHP servers, IoT devices, and cloud gateways, primarily orchestrated by botnets such as Mirai, Gafgyt, and Mozi. These campaigns exploit a range of known vulnerabilities—including `CVE-2017-9841` (PHPUnit), `CVE-2021-3129` (Laravel), and `CVE-2022-47945` (ThinkPHP)—as well as cloud misconfigurations and insecure deployments. The widespread use of PHP-based content management systems like WordPress and Craft CMS, combined with common misconfigurations and outdated plugins, has expanded the attack surface, making these environments especially attractive to threat actors seeking remote code execution or data theft opportunities. Attackers are also leveraging insecure debugging tools, such as leaving Xdebug active in production, and are actively searching for exposed credentials, API keys, and AWS secrets on internet-facing servers. IoT devices remain a persistent weak link, with vulnerabilities like `CVE-2022-22947` (Spring Cloud Gateway) and `CVE-2024-3721` (TBK DVR-4104/4216) being targeted to conscript devices into botnets. The Qualys Threat Research Unit emphasizes that the combination of known software flaws and misconfigurations continues to drive the growth of large-scale botnet activity, posing ongoing risks to enterprises and cloud environments.
Jun 29, 2026
Researchers reported renewed **Moobot** activity as operators updated infrastructure and scanned for exploitable internet-facing devices, especially **Tenda routers**, while continuing a broader pattern of targeting networking gear and embedded systems. Alien Labs linked the latest activity to a Mirai-derived botnet probing for known flaws including `CVE-2014-8361`, `CVE-2017-17215`, `CVE-2018-14558`, and `CVE-2020-10987`. Earlier reporting described Moobot as an active DDoS botnet that spread through weak Telnet credentials and exploits affecting routers, DVRs, IP cameras, GPON devices, ThinkPHP, and Android Debug Bridge, with operators using obfuscation, modified packers, DNS TXT-based command-and-control delivery, and proxy infrastructure including SOCKS and Tor to complicate analysis. Separate campaigns showed the botnet repeatedly shifting to new device classes and vulnerabilities to grow its node base. Unit 42 documented MooBot exploiting four **D-Link** router flaws — `CVE-2015-2051`, `CVE-2018-6530`, `CVE-2022-26258`, and `CVE-2022-28958` — to fetch shell-script droppers and architecture-specific binaries, while Netlab 360 and CNCERT reported exploitation of a zero-day command-injection flaw in **UNIX CCTV DVR/NVR** devices through port `8000`, affecting about **6,000** exposed systems. Across the campaigns, the malware retained core Mirai traits, including embedded credentials, persistence, and DDoS capability, while variants such as `Moobot_xor` and `Moobot_leet` introduced altered encryption keys, encrypted resources, and Tor-based C2 channels.
Aug 28, 2026